Azure Firewall

​

Overview

The Azure Firewall integration ingests diagnostic logs published by an Azure Firewall instance, including:

• AzureFirewallApplicationRule: application rule hits (URL, FQDN)
• AzureFirewallNetworkRule: network rule hits (5-tuple)
• AzureFirewallDnsProxy: DNS resolution events
• AzureFirewallThreatIntelLog: Microsoft Threat Intelligence matches

Logs are routed through an Event Hub to Atatus.

---

​

Prerequisites

• An Azure Firewall instance.
• An Event Hub namespace and hub with a Listen policy (see Azure Event Hub).

---

​

Step 1: Configure Azure Firewall diagnostic settings

1. Open the Azure portal and navigate to your Azure Firewall resource.
2. Go to Monitoring → Diagnostic settings → Add diagnostic setting.
3. Name it atatus-siem.
4. Select the log categories:
   • AzureFirewallApplicationRule
   • AzureFirewallNetworkRule
   • AzureFirewallDnsProxy
   • AzureFirewallThreatIntelLog
5. Under Destination details, choose Stream to an event hub and select your namespace, hub, and a Listen-capable Shared Access Policy.
6. Click Save.

---

​

Step 2: Connect Azure Firewall in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Azure Firewall card and click Connect.
3. Fill in the form:

4. Click Connect.

---

​

Verification

• The Azure Firewall card shows Configured.
• Firewall events appear in Security → Cloud SIEM → Audit Logs → Events with source azure_firewall.